
where \(\epsilon \sim \mathcal {N}(0,\sigma ^2 I)\)  and \(\delta \)  is an adversarial perturbation that has the same size with \(\mathbf {x}\) . The random variables \(\mathbf {X}\)  and \(\mathbf {Y}\)  represent random inputs obtained by adding isotropic Gaussian noise to the input \(\mathbf {x}\)  and its perturbed version \(\mathbf {x}+\delta \) , respectively.
Cohen et al. [1]} applied the standard Neyman-Pearson lemma [2]} to the above two random variables, and obtained the following two lemmas:
